OneLogin Integration User Guide

OneLogin Integration User Guide

Table of Contents OneLogin Account Setup... 2 Create Account with OneLogin... 2 Setup Application with OneLogin... 2 Setup Required in OneLogin: SSO and AD Connector... 4 OneLogin Website... 4 OneLogin Connector... 7 Return to OneLogin Website Active Directory Setup...10 Setup Required in ServicePRO application... 14 Provider tab...16 Sync tab...17 Verify tab...18 Prerequisites and Limitations... 19 i ServicePRO OneLogin Integration

OneLogin Account Setup Create Account with OneLogin The following outlines steps for creating an account on OneLogin, and signing up for an account. 1. Go to OneLogin.com (or directly to https://www.onelogin.com/signup?plan=free) 2. Select Product, then Pricing 3. Select the option SSO Free (SSO for your employees for up to 3 apps and 5 personal apps) 4. Enter your Name, Contact Info, Email Address and other information. Setup Application with OneLogin 1. Visit https://app.onelogin.com/login and login with the registered credentials. 2. From here, select Apps Company Apps > Add Apps 3. On this page, navigate to ServicePRO, or search for ServicePRO. Select Add ServicePRO. 4. On the Add ServicePRO page, check your basic settings and select Save from the upper right corner to save the configuration. You will be notified that your company has been added and taken to a page where you can edit additional settings. 2 ServicePRO OneLogin Integration

5. On ServicePRO s page, leave all parameters at their default pre-configured settings unless changes are required. 3 ServicePRO OneLogin Integration

Setup Required in OneLogin: SSO and AD Connector OneLogin Website 1. Go to the Users tab and select Directories, then select the New Directory link. 4 ServicePRO OneLogin Integration

2. Under Select a Directory Type, select Active Directory. 5 ServicePRO OneLogin Integration

3. Download and install the service from the Connect Active Directory page (onelogin_ad_connector.msi). Make note of the token text in Section C, as it will be required in a later step. As stated on the Connect Active Directory page: Users should login as an Administrator on the server or machine where the AD Connector will be installed. The AD Connector must be installed on a windows server on your domain. Your firewall must allow outbound traffic on port 443 to the IP ranges below: 74.205.97.176/29 108.166.38.40/29 6 ServicePRO OneLogin Integration

OneLogin Connector Open the OneLogin Connector (onelogin_ad_connector.msi) from its location to set up the Active Directory Connector. 1. For the Directory Token, copy the text in the Token field from section C of the Active Directory Setup page (Step 3-4). 7 ServicePRO OneLogin Integration

1. For Service Log On Credentials, select Run service as LocalSystem. 2. For Port Selection, the value can be left as the default (8080), provided there are no port conflicts with the current setup. 3. Once installed, the OneLogin Active Directory Connector Setup window will open. If needed, users can change or access the ADC Config Wizard by opening ADConfigWizard.exe from the directory where it is installed. 8 ServicePRO OneLogin Integration

4. In the OneLogin ADC Configuration Wizard, select Auto Populate to populate the list with available domains. 5. Check off domains you wish to use in Active Directory setup. Select Apply or OK and close the setup window by selecting Finish. 9 ServicePRO OneLogin Integration

Return to OneLogin Website Active Directory Setup After completing the steps in the OneLogin Connector Setup, return to the Active Directory Setup page in the browser. The page will refresh and the page will display the Import Users screen. 1. Select the checkboxes for the desired Organizational Units in your Active Directory. 2. Select Finish from the upper right corner when appropriate users have been selected. The Connectors list page will be loaded. 3. To begin mapping, select Users dropdown menu, then select Directories. On the Directories page, select Active Directory. NOTE: Users will require valid email address for logins to appear in the Active Directory list. 10 ServicePRO OneLogin Integration

4. To sync a user, navigate to the More Actions icon in the upper right, and select Synchronize Users. A prompt will appear, confirming The connector is synchronizing users. 11 ServicePRO OneLogin Integration

5. View the User listing from Users > All Users. If Users do not appear in the listing, ensure the user in the Organizational Unit is associated with an active email address in its Active Directory properties. 12 ServicePRO OneLogin Integration

6. To set up Mapping to your domain for a User, select the name from the User listing, and select the Applications tab, and add a New App. Ensure ServicePRO is selected as the application, and choose the correct ServicePRO Login information for the user. Ensure the connector service on the machine on your domain is set up (see steps above). 13 ServicePRO OneLogin Integration

7. Confirm the Authenticated By' setting for users is correctly set to 'OneLogin'. 14 ServicePRO OneLogin Integration

Setup Required in ServicePRO application While authenticating via OneLogin, login is only possible via email address. To authenticate OneLogin s Single Sign-on settings in ServicePRO: 1. From the ServicePRO Workbench, select Setup/Administration. 2. From here, navigate to the Configuration Tab. 3. Select System Options. 4. Select the Single Sign-on Settings option on the left side bar. 5. Enable Single sign-on functionality and edit details below by selecting the first checkbox option. 15 ServicePRO OneLogin Integration

Provider tab The following options are available under the Single Sign-on Settings page s Provider tab. Information for each field can be found on OneLogin s website, as noted in each section below. Provider: OneLogin Login URL: The first part of the URL will be unique for each client o https://[unique identifier].onelogin.com/api/v3/saml/assertion o In the example below, serviceproqa is the unique section of the URL API Key: REST API Key from OneLogin o The API Key can be found at https://admin.us.onelogin.com/session_settings, under API Key. App ID: The ID in Issuer URL is unique per client, and is visible when viewing Company App pages. o Using this URL as an example: https://admin.us.onelogin.com/apps/456859/edit The APP ID would be 456859. Automatically create user in self-service portal option: If checked, will sync the user from OneLogin to ServicePRO 16 ServicePRO OneLogin Integration

Sync tab The following options are available under the Single Sign-on Settings page s Sync tab. Sync URL: The first part of the URL will be unique for each client o https://[unique identifier].onelogin.com/api/v3/users.xml o In the example below, serviceproqa is the unique section of the URL Interval: Set the frequency for User Imports from OneLogin by Starwatch Service, in hours Import Users button: Manually import users from OneLogin Fields that are synced upon User Import will include Email Address, User Name & Status (active or inactive) 17 ServicePRO OneLogin Integration

Verify tab Users can use these options to verify the status of their OneLogin User IDs by entering the requested information. User Id: Enter the User Id for the account to be used with OneLogin Password: Enter the Password associated with the User Id account Login: Test the OneLogin functionality Status: States the status of the logged in user To log in as a User for the verification process, ensure that the User has accounts set up properly on both ServicePRO and OneLogin. This includes: Setting up User accounts with Manage Users (if not present) in ServicePRO Ensuring the User is associated with the ServicePRO application in OneLogin (See Step 6 in the section Return to OneLogin Website Active Directory Setup) In the example below, the User Joe Johnson has the ServicePRO app added to their list of applications on the User Page in OneLogin. 18 ServicePRO OneLogin Integration

Prerequisites and Limitations UserID Single sign-on (SSO) with OneLogin requires an email address (a primary SMTP email address) for User IDs when logging in. UserID or UserName cannot be used to log in, as OneLogin s free plan does not allow these fields to be mapped. Set Active Directory Authentication Method In order for SSO to begin working, Administrators will need to ensure all users imported from the Active Directory has the Active Directory authentication method set. Passthrough Authentication Passthrough Authentication is not possible with SSO using OneLogin. User Synchronization (Importing Users from OneLogin) An alternative method for user provisioning is currently being used; the current API is not officially supported by OneLogin for User Import from Active Directory via OneLogin. As a result, restrictions on User Synchronization will be present: Only approximately 1000 users may be imported Field mapping can only be performed on User Name and Email Address fields Imported users will need to be assigned to a default organizational unit. Administrators will be able to adjust the user properties at a later point if needed. 19 ServicePRO OneLogin Integration